Hacker ApprovedDepartments

Drupal

Ranked 3 of 9 content management systems by recommenders

Recommended for its mature, battle-tested architecture, large community and built-in features that avoid reinventing a CMS; critics cite frequent major-version rewrites and maintenance and security concerns.

Recommended for its mature, battle-tested architecture, large community and built-in features that avoid reinventing a CMS; critics cite frequent major-version rewrites and maintenance and security concerns.

78 people gave an opinion

recommend it
30
criticize it
48
approval share
38%
Each figure is one person. RecommendsCriticizes

Recommended in 9 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: recommended
  5. March 2026: not recommended
  6. April 2026: recommended
  7. May 2026: recommended
  8. June 2026: not recommended
  9. July 2026: not recommended
  10. August 2026: recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Owned for 6 years

Median of the 3 owners who said how long they have had it.

Each square is one year.

Why it doesn’t carry the badge

  • 30 people recommend itNeeds 10 or more, met.
  • 0.6 recommenders for every criticNeeds 2 to 1 or better, not met.
  • Recommended in 9 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Mature, proven solutions to common problems

    “build on top of a lot of well discussed well thought through solutions to these sorts of problems that the Drupal community has dealt with for a couple of decades”

    Comment from 19 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “It's a solid framework to build on without having to reinvent the CMS wheel.”

    Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “battle tested without having to make all the decisions that get you there”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”
  • Built-in features without programming

    “It has understood and workable flows for things like content approval, timed releases, etc.”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “Drupal's features and functionality match the requirements of your project the best.”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “if you fully buy into Drupal, it can do most everything without programming”

    Comment from 23 Feb 2026 in “Ladybird Browser adopts Rust”
  • Large, active community and ecosystem

    “had literally thousands of developers volunteering code to the core development project, a dedicated security team”

    Comment from 8 May 2026 in “Canvas (Instructure) LMS Down in Ongoing Ransomware Attack”

    “the overall ecosystem is so expandable and the community is great”

    Comment from 9 Apr 2026 in “Lunar Flyby”

    “Better code, better community, better architecture etc.”

    Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”
  • Foundation rebuilt over time

    “The reason Drupal can do what it does today is because of this willingness to rebuild”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “Drupal can do what it does today because it continually rebuilt it's foundation”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

What people warn about

Each mark is one comment

  • Frequent rewrites and breaking changes

    “But that rewriting the base system, every couple of years, was why I dropped it.”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “Drupal earned that reputation for so many architectural upheavals and pointless version churning”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “To be fair, they did it once, from v7 to v8. But yeah, a major release does break APIs.”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”
  • Security risks and vulnerabilities

    “Drupal is no paragon of security”

    Comment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE”

    “This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy”

    Comment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing”

    Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”
  • Steep learning curve for smaller users

    “Modern Drupal is more geared towards coders rather than smaller folks.”

    Comment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “Drupal was even better, but the barrier to entry was higher.”

    Comment from 2 Apr 2026 in “EmDash – a spiritual successor to WordPress that solves plugin security”

    “I totally saw the value for the client but I really disliked my experience, so I avoided it afterwards.”

    Comment from 31 May 2026 in “The Speed of Prototyping in the Age of AI”
  • Hard maintenance, needs SSH access

    “There's no way you're using modern Drupal without SSH access and using command line to install and update.”

    Comment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

    “Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).”

    Comment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

Other content management systems people recommend

The four most recommended other content management systems, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

Drupal compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
WordPress19432637%1215 yrs25 owners—
EmDash679142%7——
DrupalThis page304838%96 yrs3 owners—
Wagtail CMS11192%5—Approved
Sveltia CMS70100%5——
See all 9 content management systems, ranked

What people said

40 of the 96 comments that mention it, newest first. Each links to the original comment.

“Modern Drupal is more geared towards coders rather than smaller folks.”

MixedComment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“This current strategy of Drupal has high risks in terms of maintainability, stability, security and privacy”

CriticizesComment from 22 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“I like to think of Drupal as the worst CMS, except for all the others.”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“It's a solid framework to build on without having to reinvent the CMS wheel.”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“What came after was such a different beast it should have just been its own thing.”

CriticizesComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“it is genuinely a very good product now, and one that LLMs are incredibly good at building with”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“I wouldn't put Drupal or Wordpress near the top of the pile for good ones anyway, but I'd still put them above any bespoke CMS I've ever seen.”

MixedComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Drupal has been absolute mess for maintenance, backwards compatibility, responsive ness (code/dev wise).”

CriticizesComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“it's vulnerable to one of the most serious and easily-exploitable RCEs in the history of computing”

CriticizesComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“That's Drupal's strength and I don't think there's anything better for it.”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Better code, better community, better architecture etc.”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“I came to have a lot of respect for how configuration works in modern Drupal”

RecommendsComment from 21 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“To be fair, they did it once, from v7 to v8. But yeah, a major release does break APIs.”

MixedComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“When I last tried the Windows version, it didn't work and just gave the old Drupal white screen of death in the browser.”

CriticizesComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“There's no way you're using modern Drupal without SSH access and using command line to install and update.”

CriticizesComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“The reason Drupal can do what it does today is because of this willingness to rebuild”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“battle tested without having to make all the decisions that get you there”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Drupal's features and functionality match the requirements of your project the best.”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Drupal earned that reputation for so many architectural upheavals and pointless version churning”

CriticizesComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“But that rewriting the base system, every couple of years, was why I dropped it.”

MixedComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Drupal can do what it does today because it continually rebuilt it's foundation”

MixedComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“It has understood and workable flows for things like content approval, timed releases, etc.”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“The scale of publishing + users + need for governance is exploding.”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“I don't think there is a place for Drupal outside of higher educations marketing.”

MixedComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“It's actually a great target for agentic coding, because it has such a well-established internal API.”

RecommendsComment from 20 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“build on top of a lot of well discussed well thought through solutions to these sorts of problems that the Drupal community has dealt with for a couple of decades”

RecommendsComment from 19 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“at least you do have a choice or path forward when the situation arises”

RecommendsComment from 19 Oct 2026 in “Drupal is now light-years ahead of its reputation”

“Drupal is no paragon of security”

MixedComment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE”

“will check that it can't write to anything but its designated file uploads directory”

RecommendsComment from 23 Sep 2026 in “WordPress: Unauthenticated path traversal leading to conditional RCE”

“has had a commit credit system going for years that has worked well enough that people are constantly trying to game it”

RecommendsComment from 10 Sep 2026 in “Automattic's board forces CEO Matt Mullenweg into leave of absence”

“I loved its templating system (the fact that HTML was assembled on the back end) and it was so powerful!”

RecommendsComment from 12 Aug 2026 in “HTML over WebSockets: real-time SPAs with barely any JavaScript”

“Drupal and WP etc all have plugins to switch stuff on in minutes, however, customising and making it as your client wants would take a lot of time.”

MixedComment from 31 May 2026 in “The Speed of Prototyping in the Age of AI”

“I totally saw the value for the client but I really disliked my experience, so I avoided it afterwards.”

CriticizesComment from 31 May 2026 in “The Speed of Prototyping in the Age of AI”

“had literally thousands of developers volunteering code to the core development project, a dedicated security team”

RecommendsComment from 8 May 2026 in “Canvas (Instructure) LMS Down in Ongoing Ransomware Attack”

“I recommended we use Drupal in 2011. That was killed because everything had to be MS.”

MixedComment from 10 Apr 2026 in “France to ditch Windows for Linux to reduce reliance on US tech”

“the overall ecosystem is so expandable and the community is great”

MixedComment from 9 Apr 2026 in “Lunar Flyby”

“Drupal was even better, but the barrier to entry was higher.”

RecommendsComment from 2 Apr 2026 in “EmDash – a spiritual successor to WordPress that solves plugin security”

“I always liked the pragmatism surrounding it, reaching to the point of saving php code into the mysql database”

MixedComment from 23 Feb 2026 in “Ladybird Browser adopts Rust”

“if you fully buy into Drupal, it can do most everything without programming”

RecommendsComment from 23 Feb 2026 in “Ladybird Browser adopts Rust”

“it's stood the (multi-decade) test of time”

RecommendsComment from 10 Nov 2025 in “Modular monolith and microservices: Modularity is what matters”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.